{"record":{"id":"62714a4d30822a47","repo":"macrozheng/mall-swarm","slug":"error-62714a","errorCode":null,"errorMessage":"支付回调签名校验失败！","messagePattern":"支付回调签名校验失败！","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java","lineNumber":93,"sourceCode":"        try {\n            //调用SDK验证签名\n            signVerified = AlipaySignature.rsaCheckV1(params, alipayConfig.getAlipayPublicKey(), alipayConfig.getCharset(), alipayConfig.getSignType());\n        } catch (AlipayApiException e) {\n            log.error(\"支付回调签名校验异常！\",e);\n            e.printStackTrace();\n        }\n        if (signVerified) {\n            String tradeStatus = params.get(\"trade_status\");\n            if(\"TRADE_SUCCESS\".equals(tradeStatus)){\n                result = \"success\";\n                log.info(\"notify方法被调用了，tradeStatus:{}\",tradeStatus);\n                String outTradeNo = params.get(\"out_trade_no\");\n                portalOrderService.paySuccessByOrderSn(outTradeNo,1);\n            }else{\n                log.warn(\"订单未支付成功，trade_status:{}\",tradeStatus);\n            }\n        } else {\n            log.warn(\"支付回调签名校验失败！\");\n        }\n        return result;\n    }\n\n    @Override\n    public String query(String outTradeNo, String tradeNo) {\n        AlipayTradeQueryRequest request = new AlipayTradeQueryRequest();\n        //******必传参数******\n        JSONObject bizContent = new JSONObject();\n        //设置查询参数，out_trade_no和trade_no至少传一个\n        if(StrUtil.isNotEmpty(outTradeNo)){\n            bizContent.put(\"out_trade_no\",outTradeNo);\n        }\n        if(StrUtil.isNotEmpty(tradeNo)){\n            bizContent.put(\"trade_no\",tradeNo);\n        }\n        //交易结算信息: trade_settle_info\n        String[] queryOptions = {\"trade_settle_info\"};","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/macrozheng/mall-swarm/blob/04c442fe318356bae4445a109dde7af297ce1e84/mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java#L75-L111","documentation":"AlipayServiceImpl.notify calls AlipaySignature.rsaCheckV1 to verify the signature of Alipay's async payment callback using the configured Alipay public key, charset, and sign type. If verification returns false (or throws), the callback is rejected with this warning and 'failure' is returned, causing the order to never be marked paid and Alipay to retry the notification.","triggerScenarios":"A callback arrives whose params fail rsaCheckV1: wrong/placeholder alipayPublicKey (e.g., merchant app public key instead of Alipay's public key), mismatched charset or signType, params altered/missing fields (e.g., sign or sign_type stripped), or a forged/unauthorized callback request.","commonSituations":"Swapping the app's own public key with Alipay's platform public key in config; switching Alipay apps/keys between environments; sign_type mismatch after upgrading to RSA2; a proxy or gateway re-encoding the callback and corrupting parameters; attackers probing the notify URL.","solutions":["Verify alipayConfig.getAlipayPublicKey() is Alipay's platform public key (from the open platform app details), not your own application private/public key.","Confirm charset and signType in alipayConfig exactly match those used in the Alipay app settings (e.g., UTF-8, RSA2).","Ensure the notify handler receives ALL raw callback parameters unmodified (don't re-encode, reorder, or drop fields before verification).","Check that the callback URL belongs to the same Alipay app/gateway environment whose key is configured.","If the same endpoint serves sandbox traffic, use the sandbox Alipay public key accordingly."],"exampleFix":"// before (config)\nalipay.public-key=MIIBIjANBgkq...your-app-public-key...\n// after (config) - use the Alipay PLATFORM public key from open.alipay.com app settings\nalipay.public-key=MIIBIjANBgkq...alipay-platform-public-key...\nalipay.sign-type=RSA2\nalipay.charset=UTF-8","handlingStrategy":"validation","validationCode":"// Before deploying, self-test key configuration\nboolean ok;\ntry {\n    ok = AlipaySignature.rsaCheckV1(params, alipayConfig.getAlipayPublicKey(),\n            alipayConfig.getCharset(), alipayConfig.getSignType());\n} catch (AlipayApiException e) {\n    log.error(\"签名校验异常\", e);\n    ok = false;\n}\nif (!ok) { log.warn(\"拒绝回调: 签名不匹配\"); return \"failure\"; }","typeGuard":"boolean isConfigValid(AlipayConfig c) {\n    return c != null\n        && StringUtils.isNotBlank(c.getAlipayPublicKey())\n        && StringUtils.isNotBlank(c.getCharset())\n        && StringUtils.isNotBlank(c.getSignType());\n}","tryCatchPattern":"try {\n    signVerified = AlipaySignature.rsaCheckV1(params, alipayConfig.getAlipayPublicKey(),\n            alipayConfig.getCharset(), alipayConfig.getSignType());\n} catch (AlipayApiException e) {\n    log.error(\"支付回调签名校验异常!\", e);\n    return \"failure\";\n}","preventionTips":["Configure Alipay's PLATFORM public key (not your app's own key pair) in alipayConfig.","Keep charset and signType identical between your config and the Alipay app settings.","Never transform, re-encode, or partially parse callback params before signature verification.","Point notify_url at the environment matching the configured keys (sandbox vs production).","Log failing callbacks' out_trade_no and sign_type to diagnose key mismatches quickly."],"tags":["alipay","signature-verification","rsa","payment-callback","security"],"backgroundTag":"signature-verification-failed","analyzedSha":"04c442fe318356bae4445a109dde7af297ce1e84","analyzedAt":"2026-09-08T00:00:41.853Z","contentChangedAt":"2026-09-08T00:00:41.853Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}